A stored cross‑site scripting vulnerability in OpenEMR allows a patient portal user to set a login username containing an XSS payload. When a clinic staff member opens the Create Portal Login page for that patient, the injected script runs in the staff member's browser, allowing an attacker to execute arbitrary client‑side code with the staff session context.

The vulnerability affects OpenEMR installations before version 8.0.0.2. All users running those earlier releases are at risk, while version 8.0.0.2 and later contain the fix.

The CVSS score is 5.4, reflecting a moderate severity. The EPSS score is below 1%, indicating a low likelihood of observed exploits, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate patient portal account that can set a username; the attack then requires a staff member to view the credential print page, which is typically a routine administrative action. Given these constraints the overall risk remains moderate, but the impact of execution in an administrative session is significant.